CVE-2026-45937: Linux Kernel EIP93 DOS Vulnerability

CVE-2026-45937 Overview

CVE-2026-45937 is a Linux kernel vulnerability in the inside-secure/eip93 crypto driver. During driver detach, the same hash algorithm is unregistered multiple times because of a wrong iterator in the cleanup path. The repeated unregistration triggers a kernel panic, resulting in a denial-of-service condition on systems using the affected hardware crypto offload driver. The issue has been resolved upstream through kernel commits in the stable tree.

Critical Impact
A kernel panic during driver detach can crash the host, interrupt services relying on the EIP93 crypto engine, and prevent clean module teardown on affected Linux systems.

Affected Products

Linux kernel versions containing the inside-secure/eip93 crypto driver prior to the fix
Systems using the Inside Secure EIP-93 hardware crypto accelerator
Embedded and networking platforms (commonly MIPS/ARM SoCs) shipping with the EIP93 driver

Discovery Timeline

2026-05-27 - CVE-2026-45937 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45937

Vulnerability Analysis

The vulnerability resides in the driver detach path of the inside-secure/eip93 Linux kernel crypto driver. The driver registers multiple algorithms, including hash algorithms, with the kernel crypto API at initialization. During teardown, a loop iterates over registered algorithms to call the matching unregister function. The loop uses an incorrect iterator, causing the same hash algorithm structure to be passed to the unregistration routine more than once.

Unregistering an already-removed crypto algorithm dereferences stale or freed list entries inside the kernel crypto subsystem. The result is a kernel panic on driver unload, module removal, or hot-unplug of the EIP93 device. The fix corrects the iterator so each algorithm is unregistered exactly once.

Root Cause

The root cause is an iterator error [CWE-670] in the cleanup loop of the EIP93 crypto driver. The loop variable referenced the wrong array or index, repeating cleanup operations on identical hash algorithm entries rather than walking the full list of distinct registrations.

Attack Vector

Triggering the panic requires the ability to detach the driver, unload the module, or initiate a device removal event. On affected systems, this typically requires local privileges sufficient to invoke rmmod or to remove the underlying device. The flaw is a stability and availability issue rather than a remote code execution vector. The vulnerability mechanism is documented in the upstream commits referenced in the Kernel Git Commit Details.

Detection Methods for CVE-2026-45937

Indicators of Compromise

Kernel panic messages referencing crypto_unregister_ahash or eip93 symbols in dmesg or serial console output
System crash or reboot events correlated with rmmod eip93 or driver detach operations
Repeated entries for the same hash algorithm name in crypto subsystem trace logs prior to crash

Detection Strategies

Inventory Linux hosts running kernels that include the inside-secure/eip93 driver and verify whether they have applied the upstream fix commits
Compare running kernel versions against the patched stable releases referenced in the kernel.org commit links
Review crash dumps using crash or kdump to identify double-unregister patterns in the crypto subsystem

Monitoring Recommendations

Forward dmesg and kernel ring buffer output to a centralized logging system and alert on panic or oops events
Track module load and unload events for eip93 through auditd rules
Monitor for unexpected reboots on embedded and networking devices that use the EIP93 crypto engine

How to Mitigate CVE-2026-45937

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the kernel.org stable commits to all systems running the inside-secure/eip93 driver
Restrict the ability to unload kernel modules to privileged administrators only
Avoid manual driver detach or rmmod eip93 operations on production systems until patched

Patch Information

The fix is available in the mainline and stable Linux kernel trees. Refer to the commits at kernel.org commit 7530c359, kernel.org commit 91c6f250, and kernel.org commit b6e32ba6. Rebuild and deploy a kernel that includes these commits, or install a distribution kernel update that backports the fix.

Workarounds

Blacklist the eip93 module on systems that do not require hardware crypto offload from the EIP93 engine
Restrict shell access and CAP_SYS_MODULE capability to limit who can trigger driver detach
Disable hot-unplug for the EIP93 device on platforms where this is configurable in device tree or firmware

bash

# Configuration example: prevent loading of the vulnerable driver until patched
echo "blacklist eip93" | sudo tee /etc/modprobe.d/blacklist-eip93.conf
sudo update-initramfs -u